At 12:04 PM -0500 10/28/00, Igor Chudov wrote:

...

As for finding ways to see who is avoiding looking at yoiur advertisements, most of the ad filtering is done at the recipient's machine, right? Gonna be hard for you to reach into their machines to see if they're running ad busters in a local script.

This may or may not be true. This all depends on how junkbusters script works. Perhaps junkbusters filters out all 480x90 images, for instance. In which case I can place a 480x90 transparent gif at the bottom of my entrance page, and upon request of such gif I can set something in the user's cookie that would allow him/her further browsing. A lot of things are computer detectable.

Well, you have it completely within your power to do experiments yourself, right now, at your own site. Visit a site like www.junkbusters.com and download their filters and then apply them against your own site. Everything you need to experiment with blocking their cookie-blocking tools is right there. (I just visited this site, and your own site, www.algebra.com, to see what it is you're so worried about people filtering out. Frankly, your ads were not nearly as obtrusive as some are, e.g., those ads running across the top, the bottom, and on both _sides_. Why you are worried that ads for "Gel Mouse Pads" will get blocked is beyond me...most clueless high school students trying to get your site to do their algebra homework for them will not be bothering with ad-busting proxies and other such filters.) --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

Igor Chudov wrote:

This may or may not be true. This all depends on how junkbusters script works. Perhaps junkbusters filters out all 480x90 images, for instance. In which case I can place a 480x90 transparent gif at the bottom of my entrance page, and upon request of such gif I can set something in the user's cookie that would allow him/her further browsing. A lot of things are computer detectable.

why don't you simply look at the source?

Maybe it is collapsing for companies who hire dozens of programmers to create some trivial nonsensical sites, e.g. drkoop.com. I created my site by myself, with no costs other than my time involved (and I enjoyed doing it anyway, so the true cost is near zero), and banners nicely supplement my income. I am not looking for a multimillion IPO, just looking to make some $$ after all expenses. I have the benefit of a nice name (www.algebra.com), so I do not need to spend any $$ at all to attract visitors.

without sparking a political discussion about the PC of banner ads, your main problem is that banner services (i.e. external sources) are undetectable to you because junkbuster never does anything to YOUR site - it just refuses to grab the ads from the external site. you may have a way if you would serve the banners yourself. but I doubt there's money in that.

On Sun, Oct 29, 2000 at 10:42:46AM -0800, Alan Olsen wrote:

At 09:31 AM 10/28/00 -0700, Tim May wrote:

...

At 11:19 AM -0500 10/28/00, Igor Chudov wrote:

...

I have a website (www.algebra.com) that makes money from banners. I have a suspicion that a small percentage of my users uses Junkbusters proxy in order to avoid seeing my banners.

I do not want to serve such users at all and I do not want them to use my bandwidth.

Is there any way to detect a user of Junkbusters in a CGI/mod_perl script?

Your presumably-misspelled subject line, "Ho to KICK OUT Junkbusters users," seems ironically appropriate.

Though some prefer the spelling "Hoe."

...

As for finding ways to see who is avoiding looking at yoiur advertisements, most of the ad filtering is done at the recipient's machine, right? Gonna be hard for you to reach into their machines to see if they're running ad busters in a local script.

Actually you can. Junkbusters mucks with the http headers for client type.

Other filtering proxies don't mess with the Agent line, or let you send whatever you want there ("Hi! I'm running X10 on MVS!"). I don't think that a high percentage of people use filtering proxies. You could make a rough guess by analyzing your log files to see which users are reading the content pages and not requesting the ads... but that's only possible if you're serving the ads yourself. You'd have to account for people who end the session early, therefore don't request the ads. If many sites implement anti-filtering methods, the ad filter writers will figure out a way to get around it. I'd do it. It'd be pretty easy- simply request the ads but don't send them to the browser. I suppose that you could then add 1x1 stealth gifs to the ads to see if the ads are getting to the browser, but then I'd just code the filter to parse the HTML stream and request those .gifs.... you can't win. Besides, if the market for web ads is a free market, the number of people who filter out ads is already factored into the price that you're getting. It's probably about $1.25 a month. :-) -- Eric Murray Consulting Security Architect SecureDesign LLC http://www.securedesignllc.com PGP keyid:E03F65E5

There has recently been some discussion on UKcrypto of a hypothesised eavesdropping-safe boot CD containing OS & necessary software to get encrypted IP links to a (predetermined?) safe site. http://homepage.ntlworld.com/peter.fairbrother/ The "won't be able to import files" and so on sounds familiar from a long time ago. Isn't this the case in the maximum implementation of the old coloured book standards? (Too boring to look it up) Also I'd like to see a "multi-platform CD that users boot from" that would work with OC, Mac, Sun etc... Ken first few lines:

Moot! is a cryptosuite designed to avoid RIPA pt3 and govermnent access to keys/plaintext in general. All storage is in an offshore data haven.

Moot! is designed to consist of a multi-platform CD that users boot from. It is designed to be hard to emulate in software.

It's also open-source, free if I can get enough help, or at least cheap, and I plan to publish the security designs and ask for comments and suggestions (and help!) before actually implementing anything.

It works sort of like this: in the box (on the CD): w/p, spreadsheet, database s/w etc: crypto package: comms s/w eg TCP/IP, modem and ethernet drivers etc.: minimal operating system: no local storage

On Sat, 28 Oct 2000, Tim May wrote:

As for finding ways to see who is avoiding looking at yoiur advertisements, most of the ad filtering is done at the recipient's machine, right? Gonna be hard for you to reach into their machines to see if they're running ad busters in a local script.

Unless they're running Windows with one of the numerous vulnerabilities announced this month. Then it becomes rather easy to reach into their system and do all sorts of nice things. Alexandra

Max Inux wrote:

...

I have a website (www.algebra.com) that makes money from banners. I have a suspicion that a small percentage of my users uses Junkbusters proxy in order to avoid seeing my banners.

I do not want to serve such users at all and I do not want them to use my bandwidth.

Is there any way to detect a user of Junkbusters in a CGI/mod_perl script?

Thanks

- Igor.

Are you payed per impression or display? Odds are blocking them wont make

Did you mean "per impression or per click"? I am paid for both, t is a mixture, about 60% are per impression and 40% or so are per click.

them leave anyways, if there is something of value, they will outsmart your blocking. A common thing for people to do also is to use DNS entries for doublclick and all the other add servers so they dont talk to the hsots, or use other software, JunkBuster is not the only solution.

I tried blicking doubleclick via DNS, it did not work well because of their javascript. - Igor.

On Sat, Oct 28, 2000 at 08:15:22PM -0400, Greg Newby wrote:

Let's assume you could catch Junkbusters users this way. Their workaround might be to GET the banner file, but abort the connection before the file transfers. Much tougher to catch.. You're be burning far more CPU cycles than just for regular Web serving. It's not clear

Interrupted downloads may be reported in Apache's error log... -Declan

Bill Stewart wrote:

At 11:19 AM 10/28/00 -0500, Igor Chudov wrote:

...

Is there any way to detect a user of Junkbusters in a CGI/mod_perl script?

Most advertising banners come from one of three sources - - advertiser.com/whatever - ads.website.com/whatever (IP address may belong to advertiser.com) - website.com/whatever (website.com's IP address and CGI.)

The usual way banner-killers work is to recognize advertiser.com's name and not download pages or accept cookies from there. Some may be fancier and check the IP address as well as the name. It's much harder to junkblock banners that are really on your site - but that means that your advertiser needs to have a setup that lets you work that way, which most don't (partly for fraud prevention, though I suppose it's less of an issue for clickthroughs.) Others may look for banner-shaped things - that's hard to stop. And then there are folks who turn off images entirely :-)

Your goal can probably be interpreted as "how to detect whether a user downloaded my advertising banner before showing them real content?". You can't keep them from seeing the text of your main page before they download the banner, because that's what includes the call for the banner image. (You could do one of those initial pages that flashes up briefly and then calls the real page, though.) If your webserver is bright enough (or if you hack it enough yourself), you could keep it from showing future images if the caller hasn't read the image. That's only possible if you know whether they've downloaded your banner, which usually means that the banner has to be hosted on your site rather than the advertiser's.

Lots of people turn off cookies - you'd mentioned the issue of using cookies to tell if people have fetched your banner. But even for people who accept cookies, the cookie protocols will only let you fetch cookies with your second-level domain, so you also need to use one of the banner locations with your domain.

A thoughtful message. Thanks. Basically my site absolutely relies on cookies for several things, such as the linear algebra workbench, standardized testing, and "My Homework". Maybe the desire to reject junkbusters users is due to my asshole personality rather than arational business thinking. I think that Tim is right, the clueless kiddos who visit algebra.com do not run junkbusters. - Igor.

sunder wrote:

Igor Chudov wrote:

...

I have a website (www.algebra.com) that makes money from banners. I have a suspicion that a small percentage of my users uses Junkbusters proxy in order to avoid seeing my banners.

And what's so special about your website that viewers couldn't find the same content elsewhere, or would be willing to turn out viewing the ads just for your site?

Maybe there is nothing special about my site. And I don't mind junkbusters users going elsewhere. I just do not want them to waste my precious bandwidth.

If someone's actively filtering out ads from your site, it is of course your right to not let them have access, but it's not likely that they would bend over backwards to tell JunkBusters or one of the other filters to let them view your banners. So unless you have some unique and very compelling/attractive content, you're just going to alienate more users.

Well, they are pretty useless to me anyway.

And setting a cookie on a web tracking GIF is not likely to win you any friends either. Look at it this way, if they're filtering banner ads, they're likely filtering cookies also. Even if you redirect them to a page that says "To view my great wonderous site, turn on cookies and allow banner ads" you are now forcing users to go through even more contortions.

They cannot use many features of my site without cookies anyway. These features include a linear algebra workbench (a unique service as far as I was able to determine), standardized testing, "My Homework" and so on. These features store a lot of session information about the users and use cookies to reference the stored data.

At which point the smarter ones will realize that they need a specific cookie, and will just set it by hand.

I am not interested in a war of wits. I think that if 1) I indeed have a nmeasurable part of bandwidth being used by junkbusters users, and 2) junkbusters are easy to detect, then I woul dlike to do it and kick them out. I do not have the mania grandioza to believe that Junkbusters will do anything just because Algebra.com found a smart ass way to detect their users. - Igor.